From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935185AbcCPUGj (ORCPT ); Wed, 16 Mar 2016 16:06:39 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:41476 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934130AbcCPUGh (ORCPT ); Wed, 16 Mar 2016 16:06:37 -0400 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Greg Kroah-Hartman , Moritz Muehlenhoff , Luis Henriques , Kamal Mostafa Subject: [PATCH 3.19.y-ckt 01/70] [stable-only] AIO: properly check iovec sizes Date: Wed, 16 Mar 2016 13:04:54 -0700 Message-Id: <1458158763-9614-2-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 2.7.0 In-Reply-To: <1458158763-9614-1-git-send-email-kamal@canonical.com> References: <1458158763-9614-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 3.19 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org v3.19.8-ckt17 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Greg Kroah-Hartman In Linus's tree, the iovec code has been reworked massively, but in older kernels the AIO layer should be checking this before passing the request on to other layers. Many thanks to Ben Hawkes of Google Project Zero for pointing out the issue. Reported-by: Ben Hawkes Acked-by: Benjamin LaHaise Tested-by: Willy Tarreau Signed-off-by: Greg Kroah-Hartman Cc: Moritz Muehlenhoff Signed-off-by: Luis Henriques Signed-off-by: Kamal Mostafa --- fs/aio.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index ebd0e9b..6a17d03 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1390,11 +1390,16 @@ static ssize_t aio_setup_single_vector(struct kiocb *kiocb, unsigned long *nr_segs, struct iovec *iovec) { - if (unlikely(!access_ok(!rw, buf, kiocb->ki_nbytes))) + size_t len = kiocb->ki_nbytes; + + if (len > MAX_RW_COUNT) + len = MAX_RW_COUNT; + + if (unlikely(!access_ok(!rw, buf, len))) return -EFAULT; iovec->iov_base = buf; - iovec->iov_len = kiocb->ki_nbytes; + iovec->iov_len = len; *nr_segs = 1; return 0; } -- 2.7.0